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Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) 
Status of This Memo 


This memo defines an Experimental Protocol for the Internet 
community. It does not specify an Internet standard of any kind. 
Discussion and suggestions for improvement are requested. 
Distribution of this memo is unlimited. 


Copyright Notice 
Copyright (C) The Internet Society (2005). 
IESG Note 


The content of this RFC was at one time considered by the IETF, and 
therefore it may resemble a current IETF work in progress or a 
published IETF work. This RFC is not a candidate for any level of 
Internet Standard. The IETF disclaims any knowledge of the fitness 
of this RFC for any purpose, and in particular notes that the 
decision to publish is not based on IETF review for such things as 
security, congestion control or inappropriate interaction with 
deployed protocols. The RFC Editor has chosen to publish this 
document at its discretion. Readers of this RFC should exercise 
caution in evaluating its value for implementation and deployment. 
See RFC 3932 for more information. 


Abstract 


The Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) connects 
IPv6 hosts/routers over IPv4 networks. ISATAP views the IPv4 network 
as a link layer for IPv6 and views other nodes on the network as 
potential IPv6 hosts/routers. ISATAP supports an automatic tunneling 
abstraction similar to the Non-Broadcast Multiple Access (NBMA) 
model. 
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Les 


Introduction 


This document specifies a simple mechanism called the Intra-Site 
Automatic Tunnel Addressing Protocol (ISATAP) that connects IPv6 
hosts/routers over IPv4 networks. Dual-stack (IPv6/IPv4) nodes use 
ISATAP to automatically tunnel IPv6 packets in IPv4, i.e., ISATAP 
views the IPv4 network as a link layer for IPv6é and views other nodes 
on the network as potential IPv6 hosts/routers. 


ISATAP enables automatic tunneling whether global or private IPv4 
addresses are used, and presents a Non-Broadcast Multiple Access 
(NBMA) abstraction similar to [RFC2491] [RFC2492] [RFC2529] [RFC3056]. 


The main objectives of this document are to: 1) describe the domain 
of applicability, 2) specify addressing requirements, 3) specify 
automatic tunneling using ISATAP, 4) specify the operation of IPv6 
Neighbor Discovery over ISATAP interfaces, and 5) discuss Site 
Administration, Security, and IANA considerations. 


Requirements 
The keywords MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, 


SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL, when they appear in this 
document, are to be interpreted as described in [BCP14]. 


This document also uses internal conceptual variables to describe 
protocol behavior and external variables that an implementation must 
allow system administrators to change. The specific variable names, 
how their values change, and how their settings influence protocol 
behavior are provided in order to demonstrate protocol behavior. An 
implementation is not required to have them in the exact form 
described here, as long as its external behavior is consistent with 
that described in this document. 


Terminology 


The terminology of [RFC2460] [RFC2461] applies to this document. The 
following additional terms are defined: 


ISATAP node: 
A node that implements the specifications in this document. 


ISATAP interface: 
An ISATAP node’s Non-Broadcast Multi-Access (NBMA) IPv6 interface, 
used for automatic tunneling of IPv6é packets in IPv4. 
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6. 


ISATAP interface identifier: 
An IPv6 interface identifier with an embedded IPv4 address 
constructed as specified in Section 6.1. 


ISATAP address: 
An IPv6 unicast address that matches an on-link prefix on an 
ISATAP interface of the node, and that includes an ISATAP 
interface identifier. 


locator: 
An IPv4 address-to-interface mapping: i.e., a node's IPv4 address 
and its associated interface. 


locator set: 
A set of locators associated with an ISATAP interface. Each 
locator in the set belongs to the same site. 


Domain of Applicability 


The domain of applicability for this technical specification is 
automatic tunneling of IPv6 packets in IPv4 for ISATAP nodes within 
sites that observe the security considerations found in this 
document, including host-to-router, router-to-host, and host-to-host 
automatic tunneling in certain enterprise networks and 3GPP/3GPP2 
wireless operator networks. (Other scenarios with a sufficient trust 
basis ensured by the mechanisms specified in this document also fall 
within this domain of applicability.) 


Extensions to the above domain of applicability (e.g., by combining 
the mechanisms in this document with those in other technical 
specifications) are out of the scope of this document. 


Node Reguirements 


ISATAP nodes observe the common functionality requirements for IPv6 
nodes found in [NODEREQ] and the requirements for dual IP layer 
operation found in ([MECH], Section 2). They also implement the 
additional features specified in this document. 


Addressing Requirements 
1. ISATAP Interface Identifiers 

ISATAP interface identifiers are constructed in Modified EUI-64 
format ([RFC3513], Section 2.5.1 and Appendix A) by concatenating the 


24-bit IANA OUI (00-00-5E), the 8-bit hexadecimal value OxFE, anda 
32-bit IPv4 address in network byte order as follows: 
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lo ii 313 6| 
|o 5|6 1/2 3 | 
t-——————————————— t-——————————————— 4-------------------------------- + 
|000000ug00000000|0101111011111110 | mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmn | 
t-——————————————— t-——————————————— 4-------------------------------- + 


When the IPv4 address is known to be globally unique, the "u" bit 
(universal/local) is set to 1; otherwise, the "u" bit is set to 0. 
"g" is the individual/group bit, and "m" are the bits of the IPv4 
address. 


6.2. ISATAP Interface Address Configuration 


Each ISATAP interface configures a set of locators consisting of IPv4 
address-to-interface mappings from a single site; i.e., an ISATAP 
interface’s locator set MUST NOT span multiple sites. 


When an IPv4 address is removed from an interface, the corresponding 
locator SHOULD be removed from its associated locator set(s). When a 
new IPv4 address is assigned to an interface, the corresponding 
locator MAY be added to the appropriate locator set(s). 


ISATAP interfaces form ISATAP interface identifiers from IPv4 
addresses in their locator set and use them to create link-local 
ISATAP addresses ([RFC2462], Section 5.3). 


6.3. Multicast/Anycast 


It is not possible to assume the general availability of wide-area 
IPv4 multicast, so (unlike 6over4 [RFC2529]) ISATAP must assume that 
its underlying IPv4 carrier network only has unicast capability. 
Support for IPv6 multicast over ISATAP interfaces is not described in 
this document. 


Similarly, support for Reserved IPv6 Subnet Anycast Addresses is not 
described in this document. 


7. Automatic Tunneling 
ISATAP interfaces use the basic tunneling mechanisms specified in 
( [MECH], Section 3). The following sub-sections describe additional 
specifications. 
7.1. Encapsulation 
ISATAP addresses are mapped to a link-layer address by a static 


computation; i.e., the last four octets are treated as an IPv4 
address. 
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7.2. Handling ICMPv4 Errors 


ISATAP interfaces SHOULD process ARP failures and persistent ICMPv4 
errors as link-specific information indicating that a path toa 
neighbor may have failed ([RFC2461], Section 7.3.3). 


7.3. Decapsulation 


The specification in ([MECH], Section 3.6) is used. Additionally, 

when an ISATAP node receives an IPv4 protocol 41 datagram that does 
not belong to a configured tunnel interface, it determines whether 

the packet’s IPv4 destination address and arrival interface match a 
locator configured in an ISATAP interface’s locator set. 


If an ISATAP interface that configures a matching locator is found, 
the decapsulator MUST verify that the packet’s IPv4 source address is 
correct for the encapsulated IPv6 source address. The IPv4 source 
address is correct if: 


— the IPv6 source address is an ISATAP address that embeds the 
IPv4 source address in its interface identifier, or 


— the IPv4 source address is a member of the Potential Router 
List (see Section 8.1). 


Packets for which the IPv4 source address is incorrect for this 
ISATAP interface are checked to determine whether they belong to 
another tunnel interface. 


7.4. Link-Local Addresses 


ISATAP interfaces use link-local addresses constructed as specified 
in Section 6 of this document. 


7.5. Neighbor Discovery over Tunnels 


ISATAP interfaces use the specifications for neighbor discovery found 
in the following section of this document. 


8. Neighbor Discovery for ISATAP Interfaces 


ISATAP interfaces use the neighbor discovery mechanisms specified in 
[RFC2461]. The following sub-sections describe specifications that 
are also implemented. 
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8.1. Conceptual Model of a Host 


To the list of Conceptual Data Structures ([RFC2461], Section 5.1), 
ISATAP interfaces add the following: 


Potential Router List (PRL) 

A set of entries about potential routers; used to support router 
and prefix discovery. Each entry ("PRL(i)") has an associated 
timer ("TIMER(i)"), and an IPv4 address ("V4ADDR(i)") that 
represents a router’s advertising ISATAP interface. 


8.2. Router and Prefix Discovery - Router Specification 


Advertising ISATAP interfaces send Solicited Router Advertisement 
messages as specified in ([RFC2461], Section 6.2.6) except that the 
messages are sent directly to the soliciting node; i.e., they might 
not be received by other nodes on the link. 


8.3. Router and Prefix Discovery - Host Specification 


The Host Specification in ([RFC2461], Section 6.3) is used. The 
following sub-sections describe specifications added by ISATAP 
interfaces. 


8.3.1. Host Variables 


To the list of host variables ([RFC2461], Section 6.3.2), ISATAP 
interfaces add the following: 


PrlRefreshInterval 
Time in seconds between successive refreshments of the PRL after 


initialization. The designated value of all ones (Oxffffffff) 
represents infinity. 
Default: 3600 seconds 


MinRouterSolicitInterval 
Minimum time in seconds between successive solicitations of the 
same advertising ISATAP interface. The designated value of all 
ones (Oxffffffff) represents infinity. 


8.3.2. Potential Router List Initialization 


ISATAP nodes initialize an ISATAP interface’s PRL with IPv4 addresses 
discovered via manual configuration, a DNS Fully Qualified Domain 
Name (FQDN) [STD13], a DHCPv4 option, a DHCPv4 vendor-specific 
option, or an unspecified alternate method. FQDNs are established 
via manual configuration or an unspecified alternate method. FQDNs 
are resolved into IPv4 addresses through a static host file lookup, 
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guerying the DNS service, guerying a site-specific name service, or 
with an unspecified alternate method. 


After initializing an ISATAP interface's PRL, the node sets a timer 
for the interface to PrlRefreshInterval seconds and re-initializes 
the interface’s PRL as specified above when the timer expires. When 
an FQDN is used, and when it is resolved via a service that includes 
TTLs with the IPv4 addresses returned (e.g., DNS ’A’ resource records 
[STD13]), the timer SHOULD be set to the minimum of 
PrlRefreshInterval and the minimum TTL returned. (Zero-valued TTLs 
are interpreted to mean that the PRL is re-initialized before each 
Router Solicitation event; see Section 8.3.4.) 


8.3.3. Processing Received Router Advertisements 


To the list of checks for validating Router Advertisement messages 
(IRFC2461), Section 6.1.1), ISATAP interfaces add the following: 


— IP Source Address is a link-local ISATAP address that embeds 
V4ADDR(i) for some PRL(i). 


Valid Router Advertisements received on an ISATAP interface are 
processed as specified in ([RFC2461], Section 6.3.4). 


8.3.4. Sending Router Solicitations 


To the list of events after which Router Solicitation messages may be 
sent ([RFC2461], Section 6.3.7), ISATAP interfaces add the following: 


— TIMER(i) for some PRL(i) expires. 


Since unsolicited Router Advertisements may be incomplete and/or 
absent, ISATAP nodes MAY schedule periodic Router Solicitation events 
for certain PRL(i)s by setting the corresponding TIMER (i). 


When periodic Router Solicitation events are scheduled, the node 
SHOULD set TIMER(i) so that the next event will refresh remaining 
lifetimes stored for PRL(i) before they expire, including the Router 
Lifetime, Valid Lifetimes received in Prefix Information Options, and 
Route Lifetimes received in Route Information Options [DEFLT]. 
TIMER(i) MUST be set to no less than MinRouterSolicitInterval seconds 
where MinRouterSolicitInterval is configurable for the node, or for a 
specific PRL(i), with a conservative default value (e.g., 2 minutes). 


When TIMER(i) expires, the node sends Router Solicitation messages as 
specified in ([RFC2461], Section 6.3.7) except that the messages are 
sent directly to PRL(i); i.e., they might not be received by other 
routers. While the node continues to require periodic Router 
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10. 


Solicitation events for PRL(i), and while PRL(i) continues to act as 
a router, the node resets TIMER(i) after each expiration event as 
described above. 


4. Neighbor Unreachability Detection 


Hosts SHOULD perform Neighbor Unreachability Detection ([RFC2461], 
Section 7.3). Routers MAY perform neighbor unreachability detection, 
but this might not scale in all environments. 


After address resolution, hosts SHOULD perform an initial 
reachability confirmation by sending Neighbor Solicitation messages 
and receiving a Neighbor Advertisement message. Routers MAY perform 
this initial reachability confirmation, but this might not scale in 
all environments. 


Site Administration Considerations 


Site administrators maintain a Potential Router List (PRL) of IPv4 
addresses representing advertising ISATAP interfaces of routers. 


The PRL is commonly maintained as an FODN for the ISATAP service in 
the site’s name service (see Section 8.3.2). There are no mandatory 
rules for the selection of the FQDN, but site administrators are 
encouraged to use the convention "isatap.domainname" (e.g., 
isatap.example.com). 


When the site’s name service includes TTLs with the IPv4 addresses 
returned, site administrators SHOULD configure the TTLs with 
conservative values to minimize control traffic. 


Security Considerations 
Implementors should be aware that, in addition to possible attacks 


against IPv6, security attacks against IPv4 must also be considered. 
Use of IP security at both IPv4 and IPv6 levels should nevertheless 


be avoided, for efficiency reasons. For example, if IPv6 is running 
encrypted, encryption of IPv4 would be redundant unless traffic 
analysis is felt to be a threat. If IPv6 is running authenticated, 


then authentication of IPv4 will add little. Conversely, IPv4 
security will not protect IPv6 traffic once it leaves the ISATAP 
domain. Therefore, implementing IPv6 security is required even if 
IPv4 security is available. 


The threats associated with IPv6 Neighbor Discovery are described in 
[RFC3756]. 
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ITs 


T2; 


There is a possible spoofing attack in which spurious ip-protocol-41 
packets are injected into an ISATAP link from outside. Since an 
ISATAP link spans an entire IPv4 site, restricting access to the link 
can be achieved by restricting access to the site; i.e., by having 
site border routers implement IPv4 ingress filtering and ip- 
protocol-41 filtering. 


Another possible spoofing attack involves spurious ip-protocol-41 
packets injected from within an ISATAP link by a node pretending to 
be a router. The Potential Router List (PRL) provides a list of IPv4 
addresses representing advertising ISATAP interfaces of routers that 
hosts use in filtering decisions. Site administrators should ensure 
that the PRL is kept up to date, and that the resolution mechanism 
(see Section 9) cannot be subverted. 


The use of temporary addresses [RFC3041] and Cryptographically 
Generated Addresses [CGA] on ISATAP interfaces is outside the scope 
of this specification. 


IANA Considerations 


The IANA has specified the format for Modified EUI-64 address 
construction ([RFC3513], Appendix A) in the IANA Ethernet Address 
Block. The text in Appendix A of this document has been offered as 
an example specification. The current version of the IANA registry 
for Ether Types can be accessed at: 


http://www.iana.org/assignments/ethernet-numbers 
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Appendix A. Modified EUI-64 Addresses in the IANA Ethernet Address 
Block 


Modified EUI-64 addresses ([RFC3513], Section 2.5.1 and Appendix A) 
in the IANA Ethernet Address Block are formed by concatenating the 
24-bit IANA OUI (00-00-5E) with a 40-bit extension identifier and 
inverting the "u" bit; i.e., the "u" bit is set to one (1) to 
indicate universal scope and set to zero (0) to indicate local scope. 


Modified EUI-64 addresses have the following appearance in memory 
(bits transmitted right-to-left within octets, octets transmitted 
left-to-right): 


0 23 63 
| OUI | extension identifier 
000000ug00000000 01011110XXXXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX 


When the first two octets of the extension identifier encode the 
hexadecimal value OxFFFE, the remainder of the extension identifier 
encodes a 24-bit vendor-supplied id as follows: 


0 23 39 63 
| OUI | OxFFFE | vendor-supplied id | 
000000ug00000000 0101111011111111 11111110xxxxxxxx XXXXXXXXXXXXXXXX 


When the first octet of the extension identifier encodes the 
hexadecimal value OxFE, the remainder of the extension identifier 
encodes a 32-bit IPv4 address as follows: 


0 23 31 63 
| OUI | OxFE | IPv4 address 
000000ug00000000 0101111011111110 XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX 
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